Eliminating Godra Ransomware (Crypto-Malware/Ransomware)

What is Godra ransomware? And how does it carry out its attack?

Godra ransomware is a file-encrypting virus discovered in Croatia last month. This crypto-malware affects Windows x64 systems and makes use of the AES encryption algorithm on its encryption process. It is designed to encrypt various file types like images, audio, video, documents, etc. After it successfully infiltrates the targeted system, it will make modifications on the Windows Registry to achieve persistence and to launch processes in the Windows environment.
Once it is done with the encryption, Godra ransomware creates two files, namely KAKO OTKLJUČATI VAŠE DATOTEKE.txt and KAKO OTKLJUČATI VAŠE DATOTEKE.log. The log file is the one who delivers a pop-up notification that notifies victims about data encryption, while the text file contains a detailed ransom note written in the Croatian language such as follows:
“VAŠE OSOBNE DATOTEKE SU KRIPTIRANE!!!
UPOZORENJE!
NEMOJTE POKUŠAVATI DEKRIPTIRATI VAŠE DATOTEKE SAMI. SVAKO MODIFICIRANJE DEKRIPTIRANIH DATOTEKA BESPOVRATNO ĆE IH UNIŠTITI! JEDNI NAČIN ZA DEKRIPTIRANJE VAŠIH DATOTEKA JE DA DOSLJEDNO SLIJEDITE UPUTE!!!
Što se dogodilo s mojim računalom?
Sve Vaše bitne datoteke su kriptirane.
Svi Vaši dokumenti, fotografije, video materijali, baze podatka i ostale datoteke više nisu dostupne jer su kriptirane. Nemojte pokšavati i gubiti vrijeme na dekriptiranje ili povrat Vaših datoteka jer nitko ne može dekriptirati Vaše datoteke bez naše dekripcijske usluge.
Mogu li vratiti svoje datoteke?
Naravno. GARANTIRAMO vraćanje Vaših datoteke nakon plaćanja:
2.000,00 EUR (dvijetisućeeura) u BTC (BitCoin) protuvrijednosti
Imate 48 sati za slanje uplate, inače se cijena udvostručava. Također, ukoliko nakon još 72 sata ne izvršite uplatu, Vaše datoteke bit će bespovratno izgubljene. Nakon provedene uplate, pošaljite nam “User ID” i broj walleta s kojeg je napravljena uplata na
[email protected]
User ID: 1513422729
Nakon toga, poslat ćemo Vam dekripcijski softver koji će vratiti Vaše datoteke. Napominjemo da *NI NA KOJI NAČIN* ne modificirate svoje kriptirane datoteke jer povrat NEĆE biti moguć.
Možete nam poslati datoteku na
[email protected] (do 100kB) kako bi smo Vam dokazali da je dekripcija moguća.
KAKO PLATITI?
Primamo uplate samo u BTC (BitCoin) valuti. Uplata mora biti izvršena na sljedeću adresu:
13srq1SP93mEs7asR2UxWBUts3x9oUcuac
Ne koristite “deep web” novčanike poput Tor Wallet, Onion Wallet, Shadow Wallet, Hidden Wallet i slični.
Kupite BTC (BitCoin) samo sa službene BitCoin mjenjačnice!
Službena tečajna lista i cijene: https://howtobuybitcoins.info/
Preporuke za kupovinu: https://bit4coin.net/ ili https://www.coinbase.com/ ili https://xcoins.io/
Na Bit4Net nije potrebna registracija! Na Xcoins.io možete kupiti BitCoin putem PayPala!
E-mail adresa za komunikaciju:
[email protected]
Pošaljite nam e-mail s Vašim “User ID” i walletom s kojeg je uplata napravljena!
UPOZORENJE!
NEMOJTE POKUŠAVATI DEKRIPTIRATI VAŠE DATOTEKE SAMI. SVAKO MODIFICIRANJE DEKRIPTIRANIH DATOTEKA BESPOVRATNO ĆE IH UNIŠTITI! JEDNI NAČIN ZA DEKRIPTIRANJE VAŠIH DATOTEKA JE DA DOSLJEDNO SLIJEDITE UPUTE!!!”
According to the ransom note, victims are asked to transfer 2.000 Euros within 48 hours to restore files encrypted by Godra ransomware. It also includes complete recovery instructions which have a Bitcoin wallet address where victims are supposed to send their unique ID and ransom payment. Failure to pay the ransom within the given time frame will double the amount of the ransom and as per the ransom note, cyber crooks will also delete the encrypted files. As scary as the threat may sound, you shouldn’t let it get to you for it’s clearly a ploy to make you panic and pay the ransom right away. The best viable option you must to is to eliminate Godra ransomware from your computer and then try out recovery options to decrypt your encrypted files.
How does Godra ransomware proliferate?
Godra ransomware proliferates through spam emails where it pretends to be a well-known company named “Fina”. The malicious payload of the ransomware is named Prijedlog_za_ovrhu_urbr_220-2017.pdf which is attached to the spam emails. The malware-laden email has a subject line of “Elektronička obavijest o pokretnaju ovršnog postupka” which means “Electronic Notice of Enforcement of Enforcement Procedure” which looks like they were sent from a Croatian Financial agency named FINA. The company already released a statement regarding this malicious email warning customers to be careful and to get rid of the email.
Step 1: Open the Windows Task Manager by pressing Ctrl + Shift + Esc at the same time. Proceed to the Processes tab and look for suspicious processes that can be related to the Godra Ransomware.

Right-click on the processes then click Open File Location and scan them using a powerful and trusted antivirus like SpyRemover Pro. After opening their folders, end their processes and delete their folders. If the virus scanner fails to detect something that you know is suspicious, don’t hesitate to delete it.
Step 2: Open Control Panel by pressing Start key + R to launch Run and type appwiz.cpl in the search box and click OK.

Step 3: Look for Godra ransomware or any malicious program and then Uninstall it.

Step 4: Hold down Windows + E keys simultaneously to open File Explorer.
Step 5: Go to the directories listed below and then look for the malicious files created by Godra ransomware such as KAKO OTKLJUČATI VAŠE DATOTEKE.txt and KAKO OTKLJUČATI VAŠE DATOTEKE.log as well as the malicious file named Prijedlog_za_ovrhu_urbr_220-2017.pdf responsible in installing the ransomware. Delete all of these aforementioned files.

C:\Users\(your pcname)\AppData\Roaming
%TEMP%.
%USERPROFILE%\Downloads
%USERPROFILE%\Desktop

Step8. Close the File Explorer.
Before you proceed to the next steps below, make sure that you are tech savvy enough to the point where you know exactly how to use and navigate your computer’s Registry. Keep in mind that any changes you make will highly impact your computer. To save you the trouble and time, you can just use PC Cleaner Pro, this system tool is proven to be safe and excellent enough that hackers won’t be able to hack into it. But if you can manage Windows Registry well, then, by all means, go on to the next steps.
Step9. Tap Win + R to open Run and then type in regedit in the field and tap enter to pull up Windows Registry.

Step10. Navigate to the following path:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
HKCU\SOFTWARE
HKCU\SOFTWARE\WOW6432Node

Step11. Delete the registry keys and sub-keys created by Godra ransomware.
Step12. Close the Registry Editor and empty your Recycle Bin.
Try to recover your encrypted files using the Shadow Volume copies
Restoring your encrypted files using Windows’ Previous Versions feature will only be effective if Godra ransomware hasn’t deleted the shadow copies of your files. But still, this is one of the best and free methods there is, so it’s definitely worth a shot.
To restore the encrypted file, right-click on it and select Properties, a new window will pop-up, then proceed to Previous Versions. It will load the file’s previous version before it was modified. After it loads, select any of the previous versions displayed on the list like the one in the illustration below. And then click the Restore button.

Follow the advanced instructions below to ensure the removal of Godra ransomware.
Perform a full system scan using SpyRemover Pro. To do so, follow these steps:

Turn on your computer. If it’s already on, you have to reboot
After that, the BIOS screen will be displayed, but if Windows pops up instead, reboot your computer and try again. Once you’re on the BIOS screen, repeat pressing F8, by doing so the Advanced Option shows up.

To navigate the Advanced Option use the arrow keys and select Safe Mode with Networking then hit
Windows will now load the SafeMode with Networking.
Press and hold both R key and Windows key.

If done correctly, the Windows Run Box will show up.
Type in explorer http://www.fixmypcfree.com/install/spyremoverpro

A single space must be in between explorer and http. Click OK.

A dialog box will be displayed by Internet Explorer. Click Run to begin downloading the program. The installation will start automatically once a download is done.